|
| 1 | +package spdx |
| 2 | + |
| 3 | +import ( |
| 4 | + "fmt" |
| 5 | + "runtime/debug" |
| 6 | + "time" |
| 7 | + |
| 8 | + "github.com/google/uuid" |
| 9 | + "github.com/spdx/tools-golang/spdx/v2/common" |
| 10 | + spdxtools "github.com/spdx/tools-golang/spdx/v2/v2_3" |
| 11 | + |
| 12 | + "github.com/quay/claircore" |
| 13 | + "github.com/quay/claircore/pkg/cpe" |
| 14 | +) |
| 15 | + |
| 16 | +func ParseSPDXDocument(sd *spdxtools.Document) (*claircore.IndexReport, error) { |
| 17 | + pkgMap := map[string]*spdxtools.Package{} |
| 18 | + for _, p := range sd.Packages { |
| 19 | + pkgMap[string(p.PackageSPDXIdentifier)] = p |
| 20 | + } |
| 21 | + digest, err := claircore.ParseDigest(sd.DocumentName) |
| 22 | + if err != nil { |
| 23 | + return nil, fmt.Errorf("cannot parse document name as a digest: %w", err) |
| 24 | + } |
| 25 | + out := &claircore.IndexReport{ |
| 26 | + Hash: digest, |
| 27 | + Repositories: map[string]*claircore.Repository{}, |
| 28 | + Packages: map[string]*claircore.Package{}, |
| 29 | + Distributions: map[string]*claircore.Distribution{}, |
| 30 | + Environments: map[string][]*claircore.Environment{}, |
| 31 | + Success: true, |
| 32 | + } |
| 33 | + for _, r := range sd.Relationships { |
| 34 | + aPkg := pkgMap[string(r.RefA.ElementRefID)] |
| 35 | + bPkg := pkgMap[string(r.RefB.ElementRefID)] |
| 36 | + |
| 37 | + if r.Relationship == "CONTAINED_BY" { |
| 38 | + if bPkg.PackageSummary == "repository" { |
| 39 | + // Create repository |
| 40 | + repo := &claircore.Repository{ |
| 41 | + ID: string(bPkg.PackageSPDXIdentifier), |
| 42 | + Name: bPkg.PackageName, |
| 43 | + } |
| 44 | + for _, er := range bPkg.PackageExternalReferences { |
| 45 | + switch er.RefType { |
| 46 | + case "cpe23Type": |
| 47 | + if er.Locator == "" { |
| 48 | + continue |
| 49 | + } |
| 50 | + repo.CPE, err = cpe.Unbind(er.Locator) |
| 51 | + if err != nil { |
| 52 | + return nil, fmt.Errorf("error unbinding repository CPE: %w", err) |
| 53 | + } |
| 54 | + case "url": |
| 55 | + repo.URI = er.Locator |
| 56 | + case "key": |
| 57 | + repo.Key = er.Locator |
| 58 | + } |
| 59 | + } |
| 60 | + out.Repositories[string(bPkg.PackageSPDXIdentifier)] = repo |
| 61 | + if _, ok := out.Packages[string(aPkg.PackageSPDXIdentifier)]; !ok { |
| 62 | + out.Packages[string(aPkg.PackageSPDXIdentifier)] = &claircore.Package{ |
| 63 | + ID: string(aPkg.PackageSPDXIdentifier), |
| 64 | + Name: aPkg.PackageName, |
| 65 | + Version: aPkg.PackageVersion, |
| 66 | + Kind: claircore.BINARY, |
| 67 | + } |
| 68 | + } |
| 69 | + } |
| 70 | + if bPkg.PackageSummary == "distribution" { |
| 71 | + if _, ok := out.Distributions[string(bPkg.PackageSPDXIdentifier)]; !ok { |
| 72 | + dist := &claircore.Distribution{ |
| 73 | + ID: string(bPkg.PackageSPDXIdentifier), |
| 74 | + Name: bPkg.PackageName, |
| 75 | + Version: bPkg.PackageVersion, |
| 76 | + } |
| 77 | + for _, er := range bPkg.PackageExternalReferences { |
| 78 | + switch er.RefType { |
| 79 | + case "cpe23Type": |
| 80 | + if er.Locator == "" { |
| 81 | + continue |
| 82 | + } |
| 83 | + dist.CPE, err = cpe.Unbind(er.Locator) |
| 84 | + if err != nil { |
| 85 | + return nil, fmt.Errorf("error unbinding distribution CPE: %w", err) |
| 86 | + } |
| 87 | + case "did": |
| 88 | + dist.DID = er.Locator |
| 89 | + case "version_id": |
| 90 | + dist.VersionID = er.Locator |
| 91 | + case "pretty_name": |
| 92 | + dist.PrettyName = er.Locator |
| 93 | + } |
| 94 | + } |
| 95 | + out.Distributions[string(bPkg.PackageSPDXIdentifier)] = dist |
| 96 | + } |
| 97 | + } |
| 98 | + } |
| 99 | + // Make or get environment for package |
| 100 | + envs, ok := out.Environments[string(aPkg.PackageSPDXIdentifier)] |
| 101 | + if !ok { |
| 102 | + envs = append(envs, &claircore.Environment{ |
| 103 | + PackageDB: aPkg.PackageFileName, |
| 104 | + }) |
| 105 | + } |
| 106 | + if r.Relationship == "CONTAINED_BY" { |
| 107 | + switch bPkg.PackageSummary { |
| 108 | + case "layer": |
| 109 | + envs[0].IntroducedIn = claircore.MustParseDigest(bPkg.PackageName) |
| 110 | + case "repository": |
| 111 | + envs[0].RepositoryIDs = append(envs[0].RepositoryIDs, string(bPkg.PackageSPDXIdentifier)) |
| 112 | + case "distribution": |
| 113 | + envs[0].DistributionID = string(bPkg.PackageSPDXIdentifier) |
| 114 | + } |
| 115 | + } |
| 116 | + out.Environments[string(aPkg.PackageSPDXIdentifier)] = envs |
| 117 | + } |
| 118 | + // Go through and add the source packages |
| 119 | + for _, r := range sd.Relationships { |
| 120 | + aPkg := pkgMap[string(r.RefA.ElementRefID)] |
| 121 | + bPkg := pkgMap[string(r.RefB.ElementRefID)] |
| 122 | + if r.Relationship == "GENERATED_FROM" { |
| 123 | + out.Packages[string(aPkg.PackageSPDXIdentifier)].Source = &claircore.Package{ |
| 124 | + ID: string(bPkg.PackageSPDXIdentifier), |
| 125 | + Name: bPkg.PackageName, |
| 126 | + Version: bPkg.PackageVersion, |
| 127 | + Kind: claircore.SOURCE, |
| 128 | + } |
| 129 | + } |
| 130 | + } |
| 131 | + return out, nil |
| 132 | +} |
| 133 | + |
| 134 | +func ParseIndexReport(ir *claircore.IndexReport) (*spdxtools.Document, error) { |
| 135 | + // Initial metadata |
| 136 | + out := &spdxtools.Document{ |
| 137 | + SPDXVersion: spdxtools.Version, |
| 138 | + DataLicense: spdxtools.DataLicense, |
| 139 | + SPDXIdentifier: "DOCUMENT", |
| 140 | + DocumentName: ir.Hash.String(), |
| 141 | + // This would be nice to have but don't know how we'd get context w/o |
| 142 | + // having to accept it as an argument. |
| 143 | + // DocumentNamespace: "https://clairproject.org/spdxdocs/spdx-example-444504E0-4F89-41D3-9A0C-0305E82C3301", |
| 144 | + CreationInfo: &spdxtools.CreationInfo{ |
| 145 | + Creators: []common.Creator{ |
| 146 | + {CreatorType: "Tool", Creator: "Claircore"}, |
| 147 | + {CreatorType: "Organization", Creator: "Clair"}, |
| 148 | + }, |
| 149 | + Created: time.Now().Format("2006-01-02T15:04:05Z"), |
| 150 | + }, |
| 151 | + DocumentComment: fmt.Sprintf("This document was created using claircore (%s).", getVersion()), |
| 152 | + } |
| 153 | + |
| 154 | + rels := []*spdxtools.Relationship{} |
| 155 | + repoMap := map[string]*spdxtools.Package{} |
| 156 | + distMap := map[string]*spdxtools.Package{} |
| 157 | + for _, r := range ir.IndexRecords() { |
| 158 | + pkgDB := "" |
| 159 | + for _, e := range ir.Environments[r.Package.ID] { |
| 160 | + if e.PackageDB != "" { |
| 161 | + pkgDB = e.PackageDB |
| 162 | + } |
| 163 | + } |
| 164 | + pkg := &spdxtools.Package{ |
| 165 | + PackageName: r.Package.Name, |
| 166 | + PackageSPDXIdentifier: common.ElementID(r.Package.ID), |
| 167 | + PackageVersion: r.Package.Version, |
| 168 | + PackageFileName: pkgDB, |
| 169 | + PackageDownloadLocation: "NOASSERTION", |
| 170 | + FilesAnalyzed: true, |
| 171 | + } |
| 172 | + out.Packages = append(out.Packages, pkg) |
| 173 | + if r.Package.Source != nil { |
| 174 | + srcPkg := &spdxtools.Package{ |
| 175 | + PackageName: r.Package.Source.Name, |
| 176 | + PackageSPDXIdentifier: common.ElementID(r.Package.Source.ID), |
| 177 | + PackageVersion: r.Package.Source.Version, |
| 178 | + } |
| 179 | + out.Packages = append(out.Packages, srcPkg) |
| 180 | + rels = append(rels, &spdxtools.Relationship{ |
| 181 | + RefA: common.MakeDocElementID("", string(pkg.PackageSPDXIdentifier)), |
| 182 | + RefB: common.MakeDocElementID("", string(srcPkg.PackageSPDXIdentifier)), |
| 183 | + Relationship: "GENERATED_FROM", |
| 184 | + }) |
| 185 | + } |
| 186 | + if r.Repository != nil { |
| 187 | + repo, ok := repoMap[r.Repository.ID] |
| 188 | + if !ok { |
| 189 | + repo = &spdxtools.Package{ |
| 190 | + PackageName: r.Repository.Name, |
| 191 | + PackageSPDXIdentifier: common.ElementID(r.Repository.ID), |
| 192 | + FilesAnalyzed: true, |
| 193 | + PackageSummary: "repository", |
| 194 | + PackageExternalReferences: []*spdxtools.PackageExternalReference{ |
| 195 | + { |
| 196 | + Category: "SECURITY", |
| 197 | + // TODO: always cpe:2.3? |
| 198 | + RefType: "cpe23Type", |
| 199 | + Locator: r.Repository.CPE.String(), |
| 200 | + }, |
| 201 | + { |
| 202 | + Category: "OTHER", |
| 203 | + RefType: "url", |
| 204 | + Locator: r.Repository.URI, |
| 205 | + }, |
| 206 | + { |
| 207 | + Category: "OTHER", |
| 208 | + RefType: "key", |
| 209 | + Locator: r.Repository.Key, |
| 210 | + }, |
| 211 | + }, |
| 212 | + } |
| 213 | + repoMap[r.Repository.ID] = repo |
| 214 | + } |
| 215 | + out.Packages = append(out.Packages, repo) |
| 216 | + rel := &spdxtools.Relationship{ |
| 217 | + RefA: common.MakeDocElementID("", string(pkg.PackageSPDXIdentifier)), |
| 218 | + RefB: common.MakeDocElementID("", string(repo.PackageSPDXIdentifier)), |
| 219 | + Relationship: "CONTAINED_BY", |
| 220 | + } |
| 221 | + rels = append(rels, rel) |
| 222 | + } |
| 223 | + if r.Distribution != nil { |
| 224 | + dist, ok := distMap[r.Distribution.ID] |
| 225 | + if !ok { |
| 226 | + dist = &spdxtools.Package{ |
| 227 | + PackageName: r.Distribution.Name, |
| 228 | + PackageSPDXIdentifier: common.ElementID(r.Distribution.ID), |
| 229 | + PackageVersion: r.Distribution.Version, |
| 230 | + FilesAnalyzed: true, |
| 231 | + PackageSummary: "distribution", |
| 232 | + PackageExternalReferences: []*spdxtools.PackageExternalReference{ |
| 233 | + { |
| 234 | + Category: "SECURITY", |
| 235 | + // TODO: always cpe:2.3? |
| 236 | + RefType: "cpe23Type", |
| 237 | + Locator: r.Distribution.CPE.String(), |
| 238 | + }, |
| 239 | + { |
| 240 | + Category: "OTHER", |
| 241 | + RefType: "did", |
| 242 | + Locator: r.Distribution.DID, |
| 243 | + }, |
| 244 | + { |
| 245 | + Category: "OTHER", |
| 246 | + RefType: "version_id", |
| 247 | + Locator: r.Distribution.VersionID, |
| 248 | + }, |
| 249 | + { |
| 250 | + Category: "OTHER", |
| 251 | + RefType: "pretty_name", |
| 252 | + Locator: r.Distribution.PrettyName, |
| 253 | + }, |
| 254 | + }, |
| 255 | + } |
| 256 | + distMap[r.Distribution.ID] = dist |
| 257 | + } |
| 258 | + out.Packages = append(out.Packages, dist) |
| 259 | + rel := &spdxtools.Relationship{ |
| 260 | + RefA: common.MakeDocElementID("", string(pkg.PackageSPDXIdentifier)), |
| 261 | + RefB: common.MakeDocElementID("", string(dist.PackageSPDXIdentifier)), |
| 262 | + Relationship: "CONTAINED_BY", |
| 263 | + } |
| 264 | + rels = append(rels, rel) |
| 265 | + } |
| 266 | + } |
| 267 | + |
| 268 | + layerMap := map[string]*spdxtools.Package{} |
| 269 | + for pkgID, envs := range ir.Environments { |
| 270 | + for _, e := range envs { |
| 271 | + pkg, ok := layerMap[e.IntroducedIn.String()] |
| 272 | + if !ok { |
| 273 | + pkg = &spdxtools.Package{ |
| 274 | + PackageName: e.IntroducedIn.String(), |
| 275 | + PackageSPDXIdentifier: common.ElementID(uuid.New().String()), |
| 276 | + FilesAnalyzed: true, |
| 277 | + PackageSummary: "layer", |
| 278 | + } |
| 279 | + out.Packages = append(out.Packages, pkg) |
| 280 | + layerMap[e.IntroducedIn.String()] = pkg |
| 281 | + } |
| 282 | + rel := &spdxtools.Relationship{ |
| 283 | + RefA: common.MakeDocElementID("", pkgID), |
| 284 | + RefB: common.MakeDocElementID("", string(pkg.PackageSPDXIdentifier)), |
| 285 | + Relationship: "CONTAINED_BY", |
| 286 | + } |
| 287 | + rels = append(rels, rel) |
| 288 | + } |
| 289 | + } |
| 290 | + out.Relationships = rels |
| 291 | + return out, nil |
| 292 | +} |
| 293 | + |
| 294 | +// GetVersion is copied from Clair and can hopefully give some |
| 295 | +// context as to which revision of claircore was used. |
| 296 | +func getVersion() string { |
| 297 | + info, infoOK := debug.ReadBuildInfo() |
| 298 | + var core string |
| 299 | + if infoOK { |
| 300 | + for _, m := range info.Deps { |
| 301 | + if m.Path != "github.com/quay/claircore" { |
| 302 | + continue |
| 303 | + } |
| 304 | + core = m.Version |
| 305 | + if m.Replace != nil && m.Replace.Version != m.Version { |
| 306 | + core = m.Replace.Version |
| 307 | + } |
| 308 | + } |
| 309 | + } |
| 310 | + if core == "" { |
| 311 | + core = "unknown revision" |
| 312 | + } |
| 313 | + return core |
| 314 | +} |
0 commit comments